Hacker News Reader

Comment by disbelief | Hacker News Reader

I'm saying that the question of (lack of) permission is a different topic from the specific SMTP technique described in the article. The SMTP technique doesn't change anything with respect to privacy compared to standard tracking pixels. The assumption going into the article was that tracking pixels are already being used.

> the sender never asked permission to perform the tracking, nor to store the data

Well, in this case the sender would be someone using Close.io as their CRM. So they actually almost certainly do want this tracking to be performed.

View on HN

The authors use of SMTP and IMAP is confusing. This is a standard tracking pixel, performed in the same way that everybody else does it. There is nothing new here.

SMTP and IMAP are transport protocols. For transporting text around:

"By utilizing SMTPs RCPT TO command" - He's not utilising anything special. This is exactly how every other email that employs tracking pixels is sent. A separate recipient and message body for each recipient.

"Remove any messages stored by the SMTP server" ... "Google's SMTP servers store a copy of every message"

Nope. SMTP is used for mail servers to pass email about. An SMTP server doesn't store mail, apart from in it's temporary queue before forwarding it on.

"Store sent mail in IMAP" ... "If using a service like Gmail which stores all sent messages automatically in IMAP" - Again, you don't store email in a message transfer protocol.

This article reads particularly badly because of the repeated incorrect use of terminology.

[edit] And to address your comment, "they actually almost certainly do want this tracking to be performed" - "want" is an interesting word to use there. If there was a tick box in the top right corner of peoples email clients which said:

  Allow senders to track when you open a message,
  where you were when you opened it, and various
  pieces of information about your system

99% of people would untick that box.

Incorrect terminology should now be fixed. Thanks for calling that out.

Note that Google's SMTP servers do store the messages in your sent mail folder. I don't claim to know exactly how they do this (IMAP, direct access to filesystems, whatever), but the messages are stored -- and yes, obviously the SMTP protocol doesn't facilitate this but their SMTP servers perform this action.

I said "want" in the context of the _sender_ not the recipient. Ie. the person who is using Close.io to send a sales email to a recipient. In this case, the _sender_ would want to know if the email was opened or not.

When you send an email with Gmail's SMTP servers, Gmail automatically stores a copy of that message in your "sent" IMAP folder. This is what the author was talking about.

Not "in your sent IMAP folder" ... "in your sent folder, which can be accessed via IMAP"

Reply on news.ycombinator.com